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Abstract 

In a deterministic quantum key distribution (DQKD) protocol with a two-way quantum channel, 
Bob sends a qubit to Alice who then encodes a key bit onto the qubit and sends it back to Bob. 
After measuring the returned qubit, Bob can obtain Alice's key bit immediately, without basis 
reconciliation. Since an eavesdropper may attack the qubits traveling on either the Bob-Alice 
channel or the Alice-Bob channel, the security analysis of DQKD with a two-way quantum channel 
is complicated and its unconditional security has been controversial. This paper presents a security 
proof of a single-photon four-state DQKD against general attacks. 
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I. INTRODUCTION 



Quantum cryptography enables two remote parties to share an information-theoretically 
secure key, which can be used for later cryptographic applications. Since the pioneering 
protocol was presented by Bennett and Brassard in 1984 (called the BB84_protocol) 
its security against general attacks has been studied in idealized settings [21-^] and also 
■„ pracfcal setfugs |5]. MeanwhUe. a dete™i„,stic quantum key d.stdbution (DQKD) 
protocol with a two-way quantum channel has been proposed [6|, |7|, which allows Alice 
and Bob to encode and decode secret message in a deterministic manner. Bob can obtain 
Alice's key bit directly with his measurement outcomes, without a basis reconciliation step, 
which makes key distribution efficient and even a quasi-secure direct communication possible 
when the two parties are connected with an ideal two-way quantum channel [g], O]. As 
for experimental demonstrations, DQKD protocols without entanglement, e.g., the single- 



photon two-state DQKD 



9] and the single-photon four-state DQKD 



fwe call it the four- 



state protocol hereafter), were proposed. Although the security of the four-state protocol 
against some special individual attacks has been considered jilt , its security against general 
attacks has not been proved 12|. 

The difficulty of the security proof for the DQKD against general attacks is due to the 
use of a two-way quantum channel. In BB84, a qubit just travels from Alice to Bob once, 
carrying one-bit secret information. Upon receiving the qubits. Bob measures it in either 
of the alternative bases to obtain Alice's key bits. A powerful eavesdropper. Eve, whose 
capacity is only limited by the physical laws, may attack the information-carrying qubit in 
the one-way quantum channel. In the DQKD j^, however, a qubit departs from Bob to Alice 
(the forward channel. Bob- Alice), and then it carries Alice's secret key bits back to Bob (the 
backward channel, Alice-Bob). In this case. Eve might attack the qubits traveling on both 
the Bob-Alice and Alice-Bob channels. Comparing it with BB84, the security analysis of 
DQKD is complicated and its unconditional security has not been proved before Jl^ 
fact, the security of two-way DQKD has been challenged over time (see, e. 
Some of these challenges have led to refinement of the protocol and some have been refuted 




12|. In this paper, we present a security proof of the four-state protocol against general 



attacks, thus, con&ming the unconditional security of the protocol. 

This paper is organized as follows. In Sec. Ull we introduce the four-state protocol. Next 
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in Sec. Illlt we present the security proof and final key generation rate against collective 
attacks. Then we extend our security proof and key generation against general attacks. We 
finally conclude in Sec. HVl 



II. FOUR-STATE PROTOCOL 

The four-state protocol works as follows. 

1. Bob prepares n qubits randomly in one of the four states, |0), |1), |+), and |— ), where 
|±) = (|0) ± |1))/V2 and sends them to Alice. 

2. In the check mode, Alice randomly measures part of the received states in the X or 
Z basis. 

3. In the encoding mode, Alice randomly performs the unitary operations I = |0)(0| + 
|1)(1| (bit 0) or r = |0)(1| - |1)(0| (bit 1) on the rest received states. 

4. Alice sends the encoded qubits back to Bob. It is interesting to note that Y {|0), |1)} = 
{ — |0)}, and |— )} = {|— ),— 1+)}, so Bob measures each qubit in the same 
basis as the one he used for preparation. In this way. Bob can obtain Alice's key bits 



deterministically, without basis reconciliation 



5. After Bob measures all returned qubits, Alice announces her measurement results 
in the check mode. They compute the fidelity of the forward states with results of 
consistent-basis measurements, i.e., Alice measures the forward state in the same basis 
as Bob's preparing it. For instance, when Bob sends a state |0) and Alice measures it 
in the Z-basis in check mode, with a probability of /o, Alice's measurement outcome 
is |0). Similarly, they can calculate the fidelity /i, /+, and /_ of |-|-), and |— ), 
respectively. Alice and Bob discard results from the inconsistent-basis measurements. 

6. Alice announces partial of her key bits in the encoding mode. They compute the error 
rate e in the Alice-Bob channel. 

7. If Alice and Bob find the error rates in the Bob-Alice channel are not too high (sat- 
isfying Eq. (jo])), they will continue the protocol, i.e., Alice and Bob will perform 
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error correction (EC) and privacy amplification (PA) to gain the secure final key bits. 
Otherwise, we assume Alice and Bob will abort the protocol. 



III. SECURITY ANALYSIS 



A. Eve's attack in the Alice-Bob channel 



Suppose that Eve only attacks the qubits in the Alice-Bob channel. Bob prepares the 
forward qubits randomly in the state |0), |1), |+), and |— ) with the same probability, i.e., 
the forward qubit is prepared in a mixed state, = (|0)(0| + |1)(1| + |+)(+| + |— )(— 1)/4 = 
(|0)(0| + |l)(l|)/2. To gain Alice's key bits information. Eve has to distinguish Alice's 
encoded qubit = Ip^I from pf = Yp^Y in the Alice-Bob channel. Since Po = pf = 
(|0) (0| + 1 1) (1 1)/2, Eve cannot gain any information about Alice's key bits if she only attacks 
the qubits after Alice's encoding operation. Therefore, we can conclude that Eve has to 
attack the qubits traveling on both the Bob- Alice and Alice-Bob channels in order to gain 
Alice's key bits. 



B. Eve's attack in the Bob- Alice Channel 



Eve's most general quantum operation can be described by a unitary operation together 



with an ancilla 



17l |. In the Bob-Alice channel, when Bob sends a qubit in state |0) and Alice 



measures in the basis |0), she will get the measurement outcomes |0) with probability 
Cqo, or |1) with probability Cgi. Define /o = Cqq as the fidelity of state |0), which can be 
verified by Alice and Bob in their post-processing. Similarly, Alice and Bob can obtain 
fi = Cii, /+ = c^_^, and /_ = c^_, respectively. Since the state space of the forward qubit is 
two-dimensional. Eve's most general attack in the Bob-Alice channel can be written in the 
form, 

Ube\0)b\E) = coo|0)b|^oo) + coi|1)b|^oi), 
Ube\1)b\E) = cn|l)B|^ii) + Cio|0)b|Eio), 

and 

Ube\+)b\E) = c++|+)b|^++) + c+_|-)b|^+_), 
Ube\-)b\E) = c__|-)b|E__) + c„+|+)b|E_+), 
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where Cij and c±± can be treated as no- negative real numbers 23], and \Eij) and \E±±) 
forms four pairs of normalized vectors. For now, we consider the case that Eve performs a 
collective attack, i.e., Ube are the same for all qubits. This restriction can be removed with 
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and then we can prove the four-state protocol is 



quantum de Finetti theorem 
secure against general attacks. 

As discussed above, Bob's forward qubit is prepared in a mixed state = (|0)(0| + 
|l)(l|)/2. After Eve's attack in the Bob-Alice channel, the joint state of the forward qubit 
and Eve's ancilla becomes 

pBob-AHce = Ube {p"" ® \E){E\) Ube- 

After receiving the forward qubits, in the encoding mode, Alice will encode her key bits 
onto the forward qubit. With probability p = 1/2, she encodes key bit by the operation 
Ib or key bit 1 by the operation Yg. After the encoding, the state of the qubit and Eve's 
ancilla becomes 

P^^^ = ^|0)(Or®Po^^ + ^|l)(ir®pr, (3) 

where p^^ = p Bob- Alices pf^ = YBPBob-Aiice^B- Ncxt, Alice sends the encoded qubits 
back to Bob. 

After Bob measured all the returned qubits, Alice will announce her measurement out- 
comes in the check mode, so that they can gain the fidelity of Bob's forward states, /o, /i, 
/+, and /_ in the Bob-Alice channel. Alice will also publish some of her key bits to gain the 
error rate e of the key bits in the Alice-Bob channel. For simplicity, we will first consider 
the case that /o = /i and /+ = /__. 



C. Secret key generation 

The asymptotic key generation rate can be defined as r = limm^oo k{m) /m, where m is 
the size of the raw key and k{m) is the number of the final key bits. Alice sends Bob EC 
information over a classical channel so that he can correct his raw key to match Alice's. 
This EC information is encrypted using pre-shared secret key bits and thus is unknown 
to Eve. The final key is then derived by applying two-universal hashing to their common 
raw key as PA [20,]. In the asymptotic scenario, the secure key rate rp^ for secret key 
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generation is bounded by the conditional entropy of Alice and Bob's key bits given the 
quantum information of Eve about the key bits, rpA = S{p^\p^^). 

After Alice's encoding operations, Eve can gain some quantum information about Alice's 
key bit from the quantum state p^^ = tr^p^^^ that is a joint state of the backward qubit 
and her ancilla. Here, we assume the worst case that Eve uses the entire state Pbe gain 
information about the key bit, even though she may have to send part of the state to Bob. 
With Renner and Konig's results [20^, we have rpA = S{p^\p^^) = S{p^^^) — S{p^^), 
where S{p^^^) = -tr p^^^ log^ p^^^ , and S{p^^) = -tr p^^ \og2 p^^ . In the following, we 
should calculate the eigenvalues of p^^^ and p^^ to get S{p^^^) and S{p^^). 



D. Key generation rate for PA 

Let us denote that 





Eqi) 


= so + isi, 


{Eqo 


Eio) 


= uq + iui, 


{Eqo 


Ell) 


= Po + iPu 


{En 


Eio) 


= ro + iri, 


{Em 


En) 


= vo + ivi, 


{Eqi 


Eio) 


= qo + iqi, 



(4) 



where pi, qi, r^, Sj, Ui and Vi are real number. Taking the inner product of two equations of 
Eq.([I]) gives 

CooCio(^iol^oo) + CiiCoi(^oil^ii) = 0. (5) 
For simplicity, we rewrite cq = cqo = cn and ci = cqi = cio and thus we have uq = —vq and 

Ui = -Vi. ^ 

Let us calculate S^p"^^^) and S{p^^). A straightforward computation [23] shows that 
the eigenvalues of p^-^^ can be obtained as Aq f fg 4 5 g 7 § 9 = and A^2^jf ]^4]^5 = 1/4. 
Thus, we obtain S{p'^^^) = J2i ^t^^ ^'^S2 ^t^^ = 2, where we have used the convention 
OlogsO = 0. The eigenvalues of p^^ = tvAp^^^ are A^f^2,3, = 0, Af^ = i[l + (Ai + A2)], 
A^ = i[l + (Ai - A2)], Af^ = i[l - (Ai + A,)] and Af^ = i[l - (A^ - A^)], 



where Ai = ^/(cgpo + cfgo)^ + (cqPi + cfqi)'^ + cgcf (sq + ro)^ and A2 = A/cgc?(so - ro)^ 



24j |. Considering the concavity of von Neumann entropy [17|], we can find S{p 
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Af log2 Af approaches its maximum when tq = sq = qi =_Pi = 0. In this case, 



we have X^^ = i[l + (cgpo + c?go)] and A^f = i[l - (cgpo + c?go)] [25 1. 
With the eigenvalues of p^-^^ and p^^ , we get 



and (j 


D, we 


can 


get 










-) = 


Coo 


^Oo) + Coil ^01 ) + Cll 


-E'li) + Clo -Elo). 




-\E+- 


-) = 


Coo 


Eqo) — Coi -Eol) — Cll 


£"11) + Clo -Eio), 


2c_ 




-) = 


Coo 


Eqo) — Coi -Eol) + Cll 


-E'll) — Clo -Eio), 


2c_ 




-) = 


Coo 


Eqo) + Coi -Eoi) — Cll 


-Ell) — Clo -Eio)- 



When considering /+ = /_, the equations above give a crucial boundary condition, 

1 + CoPo + Cigo = 2c++. (6) 

Let us analyze the maximum of S{p^^) when the fidelity, Cg and c^_,_, were verified by Alice 
and Bob in their post-processing. 

With the boundary condition of Eq.([6]) and —1 < Po,qo < 1, after some tedious calcula- 



tion, we obtain that CgPo + CiPi > 2c^_^ — 1 — 2c| [26|| and S{p ) approaches the maximum 



when CqPo + CiPi = 2c^_,_ — 1 — 2c^ > 0. After verifying the condition c^_^_ — of > 1/2 in their 
post-processing, Alice and Bob can obtain 

S{p^^) = max{S(p^^bo,go)} 

= — log2 — 

Therefore, after verifying c^^ ~ Ci ^ 1/2 Alice and Bob can get the rate of PA against 
collective attacks, 

rPAiO = Sip''\p'''') = l-h{a (8) 
where ^ = c^_,_ — cf , and h{x) = —x loga x — (1 — x) log2(l — x) is the binary Shannon entropy. 
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In particular, if Eve does not attack the forward qubits in the Bob-Ahce channel, i.e., 
/o = /i = /+ = /- = 1, one can find that rpA(0 = 1- This states that Eve cannot gain any 
information about Alice's key bits if she doesn't attack the travel qubit in the Bob-Alice 
channel first. 

Consider the case that Eve measures each forward qubit in the Bob-Alice channel in the 
basis |0), Alice and Bob can verify that /o = /i = 1, and /+ = /_ = 1/2. In this case, 
we have rpA{C,) = 0. On the other hand. Eve can also measure each forward qubit in the 
Bob- Alice channel in the basis |-|-), |— ), which gives /+ = /_ = ! and /o = /i = 1/2, and 
thus Tp^iO = 0- That is. Eve can gain full information of Alice's key bits if she has exactly 
known the forward states before Alice's encoding operations. 

E. PA for the practical quantum channels 

For the practical quantum channels, the condition /o = /i and /+ = /_ is too strict to be 
satisfied. We can use the following strategy to symmetrize Eve's channels and eliminate this 
condition. We first identify four locations — Alice's side and Bob's side of the Bob-Alice 
and Alice-Bob channels. For each bit, we randomly insert a bit flip operation Y at these 
four locations. So the four locations are either all Y or all /. In this way, the fidelities of 
the new the Bob-Alice channel are simply the average of that of the original line [i.e., the 
new /o and /i (/+ and /_) are the average of the old /o and /i (/+ and /_)] [2^. Thus, 
this justifies the conditions /o = /i and /+ = /_ used in the previous sections. 

Now, let us simplify further. Consider the two Y operations at Alice's side located 
before and after Alice's encoding operation. Since Alice's encoding performs either Y or J, 
the two new Y operations commute with Alice's encoding operation and cancel out. Now 
consider the two Y operations at Bob's side, if he originally wants to send bit 6 = 0, 1 in 
basis W = X, Z through the the Bob- Alice channel, he now sends bit 1 — 6 in basis W to 
implement Y. When he receives the qubit from the channel Alice-Bob, he performs Y on 
the incoming qubit, measures in basis W, records the bit b', and computes 6 © 6' as Alice's 
key bit. This is the same as his measuring the incoming qubit in W, fiipping the bit result 
1 — b'tob', and computing b(Bb' as Alice's key bit. Note that the input to the raw Bob-Alcie 
channel is 1 — 6 in the basis W and the output of the raw Alice-Bob channel is measured in 
W resulting in bit 1 — b'. Thus, Bob can use this information directly to infer Alice's key 
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bit as (1 — 6) © (1 — 6') = h®h' without actually implementing the two Y operations. Since 
h is uniformly distributed, so is 1 — 6 and the original protocol is recovered (i.e., no need 
to introduce the extra four Y operations) except that the averages of the fidelities (instead 
of the individual fidelities) determined in the check mode are used in the key generation 
formulas. Specifically, we can use ^ = /+ _ + /o,i — 1 in Eq. ^ to calculate PA for any 
quantum channels in the four-state protocol, where /o,i = (coo+c^i)/2, = (c^^+c^_)/2, 
and c^j's are the original fidelities of the Bob- Alice channel determined in the check mode. 

F. Final key generation rate 

In the post-processing, Alice and Bob should estimate the fidelity in the Bob- Alice chan- 
nel, and e in the Alice-Bob channel. Then they will perform EC and PA to generate the 
final key bits. In an asymptotic scenario, after verifying 

/+,- + /o,i > 3/2, (9) 

Alice and Bob can obtain the secure final key against collective attacks with the generation 
rate 

r = 1-/1(0 -Me), (10) 

where h{e) is the amount of key bits Alice and Bob should sacrifice in EC. To compare the 
key rate performance of the two-way DQKD given by Eq. (ITOl) to that of BB84 given by 
l — 2h{e)^ we can assume a symmetric attack by Eve in the DQKD case (in which c^_^ = 1 — e 
and c\ = e) so that ^ = 1 — 2e. Thus, the key rate of DQKD is 1 — h{2e) — h{e) which is 
smaller than that of BB84 when there are errors. 



G. Security against general attacks 



Our analysis above assumes that the state p^^^ of each run of the system is independent 
of and identical to the states of other runs, i.e., we assume the entire state for the n runs is 
^pABE^(^n^ This collective-attack result can be extended to general attacks where the entire 



state is arbitrary without any restriction on the n subsystems. Note that the 



protocol is unchanged with a randomized permutation step. In light of ref. 



18 



our-state 



19|, after 



permuting the n subsystems and discarding k of them, the resulting n — k subsystems can be 
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approximated by n — k independent and identically distributed subsystems [28]. Therefore, 
the final key bits in our proof with the generation rate in Eq.f jTOj) are secure against general 
attacks. 



IV. CONCLUSION 

We have proved that the four-state protocol is secure against general attacks, thus ending 
the long-standing dispute about the security of the deterministic QKD protocols. Our work 
may be extended to other QKD protocols with a two-way quantum channel and shine new 
light on the universality of QKD. 
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CijC*.- are non-negative real number and \Eij) = 



e 'J \Eij) are normalized vectors. 
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are independent of the parameters Uj, f j, rj, Sj, pi and qi. 
[25] As discussed earlier, Eve has to attack the traveling qubit twice, on both Bob-Alice and line 
Alice-Bob channels, to gain Alice's key bits. On the Bob- Alice channel. Eve attacks the forward 
qubit to distinguish its states, and then she can determine Alice's encoding operations after 
she attacked the backward qubit on Alice-Bob channel. It is optimal for Eve to distinguish 
hen {Eoo\Eoi) = {Eoo\Eio) = (^iil^io) = (^oil^ii) = 0, (^ool^ii) = Po, and 



Alice's states w. 

(E'oil-E'io) = Qo and thus it is optimal among collective attacks in the four-state protocol. 

[26] With the boundary condition 1 -|- c^po + cfgo = 2c^+, we can get 2c^^_ — 1 — CgPo = cfgo < 
Ci\qo\ < cf, i.e., c^po > 2c^^ — 1 — cf , since \po\ < 1 and |go| < 1. Thus, we can find that 
CqPo + cfgo > cIpo - cl\qo\ > c^po - cf > 2c\^ - 1 - 2cf. Here 2c\^ - 1 - 2cf > 0, i.e., 
c^_,_ — cf > 1/2, is required and should be verified by Alice and Bob in their post-processing. 

[27] Essentially, Bob-Alice channel in Eqs. ([T]) and ([2]) is symmetrized by UbeI^P) b\E)\0) b' + 
YbUbeYb\iP) b\E)\1) B' where system B' indicates whether we have a bit flip or not. We can 
assume that we give B' to Eve after the qubit transmission so that the pure-state analysis in 
the previous sections still applies. Note that giving B' to Eve afterwards means that Ube and 
system E are independent of our extra bit flip. 

[28] The quantum de Finetti theorem applies only to finite dimensional Hilbert spaces. In our proof. 
Eve's state is a purification of Alice and Bob's state. Since the latter is finite dimensional, 
the former is also finite dimensional. Thus, Alice and Bob's knowledge about Eve's state is 
finite dimensional, despite that Eve's knowledge about her own state could still be infinite 
dimensional. This can be seen by the finite number of eigenvalues of the joint ABE state 
given in the paragraph below Eq. ([5]). Also, the Stinespring dilation theorem states that Eve's 
effective ancilla is no more than four-dimensional since the dimensional of the Hilbert spaces 
of travel qubit is two (see Sec. IIIIBp . Therefore, the application of the quantum de Finetti 
theorem is valid in our proof. 
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